@@ -1199,7 +1199,7 @@ TLSSocket.prototype._finishInit = function() {
     return;
 
   this.alpnProtocol = this._handle.getALPNNegotiatedProtocol();
-  // The servername could be set by TLSWrap::SelectSNIContextCallback().
+  // On a server, TLSWrap::PinServerName() sets it from the first ClientHello.
   if (this.servername === null) {
     this.servername = this._handle.getServername();
   }
 
@@ -104,6 +104,12 @@ SSL_SESSION* GetSessionCallback(
   return w->ReleaseSession();
 }
 
+// The server name is handled in EarlyClientHelloCallback, so this only
+// acknowledges it, which also has the TLS library store it in new sessions.
+int AcknowledgeServerName(SSL* s, int* ad, void* arg) {
+  return SSL_TLSEXT_ERR_OK;
+}
+
 // Reads a 16-bit length prefixed vector from the front of data. Returns
 // nothing if the length does not fit within data.
 std::optional<std::span<const uint8_t>> ReadVector16(
@@ -158,10 +164,7 @@ ssl_select_cert_result_t EarlyClientHelloCallback(const SSL_CLIENT_HELLO* ch) {
   // If we can't parse the hello SNI, reject it explicitly:
   if (!servername.has_value()) return ssl_select_cert_error;
 
-  // Session resumption must only be allowed for sessions with exactly the same
-  // SNI. We use the SNI to derive the session id, so no handshake can resume
-  // from a mismatched SNI value. Mismatches fall back to full handshakes:
-  if (!w->BindSessionsToServerName(*servername)) return ssl_select_cert_error;
+  if (!w->PinServerName(*servername)) return ssl_select_cert_error;
 
   if (!w->should_suspend_for_client_hello()) return ssl_select_cert_success;
 
@@ -191,10 +194,10 @@ int EarlyClientHelloCallback(SSL* s, int* al, void* arg) {
     return SSL_CLIENT_HELLO_ERROR;
   }
 
-  // Session resumption must only be allowed for sessions with exactly the same
-  // SNI. We use the SNI to derive the session id, so no handshake can resume
-  // from a mismatched SNI value. Mismatches fall back to full handshakes:
-  if (!w->BindSessionsToServerName(*servername)) return SSL_CLIENT_HELLO_ERROR;
+  if (!w->PinServerName(*servername)) {
+    *al = SSL_AD_ILLEGAL_PARAMETER;
+    return SSL_CLIENT_HELLO_ERROR;
+  }
 
   if (!w->should_suspend_for_client_hello()) return SSL_CLIENT_HELLO_SUCCESS;
 
@@ -655,8 +658,7 @@ void TLSWrap::InitSSL() {
   //   https://github.com/openssl/openssl/issues/7199#issuecomment-420670544
   SSL_set_info_callback(ssl_.get(), SSLInfoCallback);
 
-  if (is_server())
-    sc_->SetSelectSNIContextCallback(SelectSNIContextCallback);
+  if (is_server()) sc_->SetSelectSNIContextCallback(AcknowledgeServerName);
 
   ConfigureSecureContext(sc_.get());
 
@@ -1592,39 +1594,34 @@ void TLSWrap::SetServername(const FunctionCallbackInfo<Value>& args) {
   SSL_set_tlsext_host_name(wrap->ssl_.get(), *servername);
 }
 
-int TLSWrap::SelectSNIContextCallback(SSL* s, int* ad, void* arg) {
-  TLSWrap* p = static_cast<TLSWrap*>(SSL_get_app_data(s));
-  Environment* env = p->env();
-  HandleScope handle_scope(env->isolate());
-  Context::Scope context_scope(env->context());
-
-  auto servername = SSLPointer::GetServerName(s);
-  if (!servername.has_value() ||
-      !Set(env, p->GetOwner(), env->servername_string(), servername.value()))
-    return SSL_TLSEXT_ERR_NOACK;
-
-  Local<Value> ctx = p->object()->Get(env->context(), env->sni_context_string())
-      .FromMaybe(Local<Value>());
-
-  // Acknowlege the name so it's correctly stored on the session:
-  if (ctx.IsEmpty() || !ctx->IsObject()) return SSL_TLSEXT_ERR_OK;
-
-  if (!env->secure_context_constructor_template()->HasInstance(ctx)) {
-    // Failure: incorrect SNI context object
-    Local<Value> err = Exception::TypeError(env->sni_context_err_string());
-    p->MakeCallback(env->onerror_string(), 1, &err);
-    return SSL_TLSEXT_ERR_NOACK;
+// The connection's server name is fixed by its first ClientHello: later ones (a
+// renegotiation, or the second of a HelloRetryRequest) must ask for exactly the
+// same, as the connection's secure context was chosen for it.
+bool TLSWrap::PinServerName(std::string_view servername) {
+  if (flags_.servername_pinned) {
+    if (servername == servername_) return true;
+    Debug(this,
+          "ClientHello asked for server name '%s', connection pinned to '%s'",
+          servername,
+          servername_);
+    return false;
   }
+  flags_.servername_pinned = true;
+  servername_ = servername;
 
-  SecureContext* sc = Unwrap<SecureContext>(ctx.As<Object>());
-  CHECK_NOT_NULL(sc);
-  p->sni_context_ = BaseObjectPtr<SecureContext>(sc);
-
-  ConfigureSecureContext(sc);
-  CHECK_EQ(SSL_set_SSL_CTX(p->ssl_.get(), sc->ctx().get()), sc->ctx().get());
-  p->SetCACerts(sc);
+  if (!servername.empty()) {
+    HandleScope handle_scope(env()->isolate());
+    Context::Scope context_scope(env()->context());
+    if (!Set(env(), GetOwner(), env()->servername_string(), servername_)) {
+      return false;
+    }
+  }
 
-  return SSL_TLSEXT_ERR_OK;
+  // Session resumption must only be allowed for sessions with exactly the same
+  // SNI. We use the SNI to derive the session id context, so no handshake can
+  // resume from a mismatched SNI value. Mismatches fall back to full
+  // handshakes:
+  return BindSessionsToServerName(servername);
 }
 
 bool TLSWrap::BindSessionsToServerName(std::string_view servername) {
@@ -1803,6 +1800,7 @@ void TLSWrap::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackField("ocsp_response", ocsp_response_);
   tracker->TrackField("sni_context", sni_context_);
   tracker->TrackField("error", error_);
+  tracker->TrackField("servername", servername_);
   if (pending_cleartext_input_)
     tracker->TrackField("pending_cleartext_input", pending_cleartext_input_);
   if (enc_in_ != nullptr)
 
@@ -96,6 +96,7 @@ class TLSWrap : public AsyncWrap,
   }
   inline void enable_session_callbacks() { flags_.session_callbacks = true; }
   bool BindSessionsToServerName(std::string_view servername);
+  bool PinServerName(std::string_view servername);
   inline bool is_server() const { return kind_ == Kind::kServer; }
   inline bool is_client() const { return kind_ == Kind::kClient; }
   inline bool is_awaiting_new_session() const {
@@ -231,8 +232,6 @@ class TLSWrap : public AsyncWrap,
 
   int SetCACerts(SecureContext* sc);
 
-  static int SelectSNIContextCallback(SSL* s, int* ad, void* arg);
-
   static void CertCbDone(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void ClientHelloDone(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void DestroySSL(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -316,6 +315,7 @@ class TLSWrap : public AsyncWrap,
   v8::Global<v8::ArrayBufferView> ocsp_response_;
   BaseObjectPtr<SecureContext> sni_context_;
   BaseObjectPtr<SecureContext> sc_;
+  std::string servername_;
 
   // BIO buffers hold encrypted data.
   BIO* enc_in_ = nullptr;   // StreamListener fills this for SSL_read().
@@ -353,6 +353,7 @@ class TLSWrap : public AsyncWrap,
     bool write_callback_scheduled : 1;
     bool has_active_write_issued_by_prev_listener : 1;
     bool alpn_callback_enabled : 1;
+    bool servername_pinned : 1;
   };
   Flags flags_{};
 
 
@@ -0,0 +1,57 @@
+'use strict';
+
+// Once a connection's secure context is chosen, later ClientHellos for the
+// same name - the second ClientHello of a TLS 1.3 HelloRetryRequest, or a TLS
+// 1.2 renegotiation - must leave it as it is. A context with no certificate of
+// its own (here one that only sets `ca`) keeps the server's certificate, and
+// must keep it for those too.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const tls = require('node:tls');
+const fixtures = require('../common/fixtures');
+const { isBoringSSL } = require('../common/crypto');
+
+const server = tls.createServer({
+  key: fixtures.readKey('agent2-key.pem'),
+  cert: fixtures.readKey('agent2-cert.pem'),
+  // Offering only this group makes the server answer a TLS 1.3 client whose
+  // first key share is for another one with a HelloRetryRequest.
+  ecdhCurve: 'P-521',
+}, common.mustCall((socket) => {
+  assert.strictEqual(socket.servername, 'certless.example');
+  socket.resume();
+}, isBoringSSL ? 1 : 2));
+server.addContext('certless.example', { ca: fixtures.readKey('ca1-cert.pem') });
+
+function connect(maxVersion) {
+  return new Promise((resolve) => {
+    const socket = tls.connect({
+      port: server.address().port,
+      servername: 'certless.example',
+      rejectUnauthorized: false,
+      maxVersion,
+      ecdhCurve: 'P-256:P-521',
+    }, () => resolve(socket));
+  });
+}
+
+server.listen(0, common.mustCall(async () => {
+  const retried = await connect('TLSv1.3');
+  retried.end();
+
+  // BoringSSL servers don't support renegotiation.
+  if (!isBoringSSL) {
+    const renegotiating = await connect('TLSv1.2');
+    await new Promise((resolve) => {
+      renegotiating.renegotiate({}, common.mustSucceed(resolve));
+    });
+    renegotiating.end();
+  }
+
+  server.close();
+}));
Original file line number	Diff line number	Diff line change
`@@ -1199,7 +1199,7 @@ TLSSocket.prototype._finishInit = function() {`
`1199`	`1199`	`return;`
`1200`	`1200`
`1201`	`1201`	`this.alpnProtocol = this._handle.getALPNNegotiatedProtocol();`
`1202`		`- // The servername could be set by TLSWrap::SelectSNIContextCallback().`
	`1202`	`+ // On a server, TLSWrap::PinServerName() sets it from the first ClientHello.`
`1203`	`1203`	`if (this.servername === null) {`
`1204`	`1204`	`this.servername = this._handle.getServername();`
`1205`	`1205`	`}`